No abstract

We propose considering assurance as a model management enterprise: saying that a system is safe amounts to specifying three workflows modelling how the safety engineering process is defined and executed, and checking their conformance. These workflows are based on precise data modelling as in functional block diagrams, but their distinctive feature is the presence of relationships between the output data of a process and its input data; hence, the name "Workflow Plus".A typical WF + -model comprises three layers: (i) process and control flow, (ii) dataflow (with input-output relationships), and (iii) argument flow or constraint derivation. Precise dataflow modelling signifies a crucial distinction of WF + -based and GSNbased assurance, in which the data layer is mainly implicit. We provide a detailed comparative analysis of the two formalisms and conclude that GSN does not fulfil its promises.

Workflow models are used to rigorously specify and reason about diverse types of processes. The Workflow+ (WF + ) framework has been developed to support unified modelling of the control and data in processes that can be used to derive assurance cases that support certification. However, WF + is limited in its support for precise contracts on workflow models, which can enable powerful forms of static analysis and reasoning. In this paper we propose a mechanism for adding interface contracts to WF + models, which can thereafter be applied to tracing and reasoning about the uncertainty that arises when combining heterogeneous models. We specifically explore this in terms of design models and assurance case models.We argue that some of the key issues in managing some types of uncertainty can be partly addressed by use of interface contracts.

No abstract